Read the docs
TI-2026-35466 Aliases CVE-2026-48022GHSA-x426-x7cc-3fpc

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

Priority LOW 28CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-319 and CWE-346.

Summary

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00176 7th percentileScored 2026-11-07
Fix Partial wreck (hapijs): 18.1.2@hapi/wreck (npm): 18.1.2Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hapijswreckbefore 18.1.218.1.2Patch availableCNA
—@hapi/wreck (npm)before 18.1.218.1.2Patch availableGHSA-x426-x7cc-3fpc
  • wreck Vendorhapijs Affected before 18.1.2 Fixed in 18.1.2 Patch available CNA
  • @hapi/wreck (npm) Vendor— Affected before 18.1.2 Fixed in 18.1.2 Patch available GHSA-x426-x7cc-3fpc

Remediation

  • Fix · CNA wreck (hapijs) Fixed in 18.1.2
  • Fix · GHSA-x426-x7cc-3fpc @hapi/wreck (npm) Fixed in 18.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for ContainersAffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48022
  2. 2026-10-03 Alias added: GHSA-x426-x7cc-3fpc
  3. 2026-11-04 Affected versions changed · Red Hat
  4. 2026-11-04 CVSS score added · Red Hat

References

Other 5

  • TI-2026-82752 Quadratic-time parsing in @hapi/content allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-61678 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVSS 4.0MEDIUM 6.3
  • TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
  • TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
  • TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences